The simple network management protocol (SNMP) is based on a manager/agent model in which the agent requires minimal software. The SNMP, developed in 1988 has become the de facto standard for internetwork management. Because it represents a simple solution which requires little code to implement numerous vendors have been able to build SNMP agents to their products. Generally, SNMP is extensible thereby allowing vendors to easily add network management functions to their existing products. SNMP also separates the management function from the architecture of the hardware devices which broadens the base of multi vendor support.
Most of the processing power and data storage involved in the SNMP protocol resides on the management system while a complementary subset of those functions reside in the managed system. To achieve its goal of being simple SNMP includes a limited set of manual commands and responses. The management system issues get, get next and set messages to retrieve single or multiple object variables or to establish the value of a single variable. The managed agent sends a response message to complete the get, get next or set message. The managed element sends an event notification called a trap to the management system to identify the occurrence of conditions such as thresholds that exceed a predetermined value. In short there are five primitive operations namely get, get next, get response, set and trap.
Traps are asynchronous messages that notify SNMP managers of significant events that have occurred at the agent or node. Traps are sent unsolicitedly to the SNMP managers that are configured to receive them.
It will be apparent to one skilled in the art that event traps can identify potential problems with network nodes particularly if the management system receives a large number of traps from a particular node. It will also be apparent to one skilled in the art that such traps can be used by a malicious attacker to interrupt services provided by the network management system.
The CERT® Coordination Center has issued warning on potential flaws in the SNMP protocol, among others, that can be exploited for malicious attacks. A solution proposed by CERT to defend against such attacks involves identifying the offending node (i.e. the generator of the excessive SNMP event traps) and disabling SNMP on that node, if possible. Unfortunately, this is not an option for an NMS because it would no longer be able to manage that node, and this would be unacceptable to the network provider.
Another significant industry source of SNMP services addresses this problem by correlating certain types of traps so that the dissemination of duplicate traps of these types can be prevented. This technique is applied to certain standard types of traps, e.g. link up/down traps, etc. Unfortunately, this approach is limited because it doesn't address non-standard traps, e.g. unknown event traps, which cause an NMS to exhaust significant resources to analyze them.
Therefore, an improved technique for an NMS to respond to excessive SNMP event traps would be desirable. The problems with prior art solutions are, as discussed above, the CERT solution disables SNMP on the offending node which is not acceptable for a NMS while the second solution is limited to certain standard types of traps, and does not address non-standard traps such as unknown event traps, which can be particularly processing intensive to analyze.
There therefore is a need to solve the above mentioned issues.